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DIRECTOR OF CENTRAL INTELLIGENCE 

Security Committee 



SECOM-D-344 
28 October 1982 


MEMORANDUM FOR: Members, DCI Security Committee 
25X1 FROM : | 

Chairman 

SUBJECT: Policy on Unauthorized Disclosures and on Damage Assessments 


25X1 


25X1 


1. In response to SECOM tasking, the Unauthorized Disclosures Investi- 
gations Subcommittee (UDIS) submitted reports on the subject topics. These 
were intended for use by the CIA member in responding to tasking from the 
Interagency Group/Countermeasures. SECOM members were briefed on and dis- 
cussed^ thesere ports at the 12-13 October seminar. Copies of the reports, and 


of 

and review. 


covering memorandum to me, are attached for your information 


2. Members agreed at the seminar that there was no need for another 
iteration of the Willard Report, and that the DCI should again ask Judge 
Clark to complete his evaluation of it and provide recommendations to the 
President. Members also agreed to forward the paper on unauthorized 
disclosures to the CIA member for his use in responding to the IG/CM. 


3. The SECOM was unable to address the paper on a national policy on 
damage assessments. Members are requested to review the attached report on 
that subject and provide me by 10 Nove m^ lo a ? thpir rnnr . urrences or comme nts. 


Attachment 
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12 October 1982 


25X1 MEMORANDUM FOR: 

Chairman, DC I Security Committee 


25X1 FROM : 

Chairman, Unauthorized Disclosure 

Investigations Subcommittee (UDIS) 

SUBJECT: UDIS Report on Unauthorized Disclosure 

and Damage Assessment Policy 


| 


25X1 


25X1 


1. Pursuant to tasking by the Security Committee, the UDIS 
met on 17 and 24 September and on 1 and 8 October, 1982, to re- 
examine the Willard Report and to make recommendations with 
respect to that report. UDIS also met to discuss issues related 
to damage assessments. The results of our deliberations are 
embodied in the two attached papers. 

2. The first paper, "National Policy on Unauthorized 
Disclosures," presents three options to stimulate action 
regarding the problem of unauthorized disclosures. The majority 
view was that the Community continue to urge Presidential action 
on the Willard Report in its current form. 


3. The second paper, "Points for Consideration Relative to 
a National Policy on Damage Assessments," represents the views of 
UDIS on this matter and was unanimously agreed to by all of the 
members who attended t he 8 Oc tober 1982 meeting (Air Force, Army, 


CIA, DIA, Energy, FBI, 


Treasury, and Navy). 


4. The UDIS also discussed the initiative by the Attorney 
General which calls for establishing an inter-agency group which 
would review leak cases which are submitted to the Department of 
Justice with the recommendation that they be investigated by the 
FBI. Deputy Attorney General Mark Richard had indicated that he 
wanted Intelligence Community participation in the group and, in 
fact, had suggested that the UDIS might constitute this review 
group. UDIS members attending the 8 October 1982 meeting felt 
that the UDIS did have a role to play in this area and requested 
guidance from the Security Committee as to whether UDIS should 
either participate in, or form the nucleus of, this inter-agency 
group . .1 I . . 


Attachments: As stated 
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NATIONAL POLICY ON UNAUTHORIZED DISCLOSURES 


I. Background 

Unauthorized disclosures of classified information represent 
a lack of discipline within the U.S. Government which may result 
in one or more of the following: 1) the disclosure of classified 
or other sensitive government information, 2) the compromise and 
negation of various intelligence sources and methods, and 3) the 
foreclosure of policy options available to senior governmental 
decision makers. In many circumstances, unauthorized disclosures 
have a negative and debilitating impact upon the effective and 
efficient functioning of government. 

Over the years, successive Administrations have attempted 
with varying degrees of success to eliminate such disclosures. 

It is clear, therefore, that a national policy on unauthorized 
disclosures does exist, i.e. unauthorized disclosures must be 
stopped. The most recent examination of the problem of unautho- 
rized disclosures occurred in early 1982. At that time, an 
interdepartmental group consisting of representatives from 
Central Intelligence Agency, and the Departments of Defense, 
Energy, Justice, State and Treasury, prepared a report (the 
Willard Report) designed to improve the Government's ability to 
protect classified information and prevent unauthorized 
disclosures. The remedial steps suggested were: 

a. that the Administration support legislation to 
strengthen existing criminal statutes that prohibit the 
unauthorized disclosure of classified information. 

Rather than trying to prosecute federal employees under 
the espionage laws, it was recommended that a new 
statute be enacted which would make it a criminal 
offense for a federal employee or contractor to disclose 
classified information to unauthorized persons? 

b. that all persons with authorized access to 
classified information be required to sign binding and 
enforceable secrecy agreements acknowledging that they 
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have been informed of their obligation to protect the 
classified information to which they have access. These 
secrecy agreements would include a prepublication review 
requirement; 

c. that agencies adopt appropriate policies to govern 
contacts between media representatives and government 
officials; 

d. that each agency that originates or stores 
classified information adept internal procedures to 
ensure that unauthorized disclosures of classified 
information are effectively investigated and that 
appropriate sanctions are imposed for violations; 

e. that where the Department of Justice and the 
affected agencies believe an investigation is warranted, 
the FBI be permitted to investigate unauthorized 
disclosures of classified information under circum- 
stances where the immediate result of a successful 
investigation would be imposition of administrative 
sanctions rather than criminal prosecution; 

f. that existing agency regulations be modified to 
permit the use of polygraph examinations of government 
employees under carefully defined circumstances; and 

g. that authorities for the federal personnel security 
program be revised and updated. 

There appears to be broad support for the recommendations set 
forth in the Willard Report with the exception of the polygraph 
and prepublication review provisions. There was some concern 
that the polygraph would be objectionable to senior government 
officials and military personnel and that it was too drastic, 
intrusive and unreliable to be used in most leak investiga- 
tions. The proponents of polygraph testing, on the other hand, . 
point to thirty years of experience in utilizing the polygraph in 
security investigations. This experience suggests that the 
polygraph is not only reliable, it serves as an important 
deterrent to inappropriate handling of classified information. 
Moreover, it was noted that the polygraph recommendation was very 
narrowly focused. The polygraph would only be used when a small 
number of individuals had been identified as potential suspects 
and the examination itself would be limited to the unauthorized 
disclosure being investigated and would not include lifestyle 
questions. 
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In a similar vein, the prepublication review requirement has 
been viewed in some circles as inappropriate for senior 
government officials and others whose post government activities 
would involve the writing of numerous works for publication. 
Proponents argued that existing secrecy agreements already 
restricted such publication. They noted, moreover, that the U.S. 
Supreme Court has indicated that the prepublication review 
requirement was implied in the granting of access to classified 
information, whether or not an agreement had been signed. . 
Proponents, therefore, suggested that including a prepublication 
clause in the secrecy agreement served only to make explicit 
existing legal requirements. They argued, moreover., that it was 
only fair that individuals signing secrecy agreements be placed 
on clear notice as to what their obligations were in this regard. 

The Willard Report, after being approved by the Attorney 
General, was forwarded to Judge Clark, Assistant for National 
Security Affairs, for presidential approval and promulgation. 

The Report has been with Judge Clark for some time and the 
prospects of it being sent to the President prior to the November 
elections appear dim. We understand that Judge Clark has 
requested explanations of the various provisions of the Report 
from his legal officer but it is unclear when the Report will be 
forwarded to the President. 

II. Issues for Decision: 

There are three suggested strategies to stimulate action on 
the Willard Report. The first option is to withdraw the Willard 
Report, and begin again with a new study containing a different 
mix of recommendations. For example, access to controlled 
government facilities might be withdrawn if individuals (e.g., 
journalists) with such access knowingly compromised classified 
information. A new and restructured report might recommend an 
Executive Order on the subject of unauthorized disclosures rather 
than the National Security Decision Directive suggested by the 
Willard Report. 

The advantage of this option is that it capitalizes on the 
additional thinking within the Community that has occurred since 
the writing of the Willard Report. A paper with all of the 
strengths but none of the supposed weaknesses of the Willard 
Report could be written. The risk associated with this strategy 
is that the new paper would compete against the Willard Report 
and, ' rather than stimulating action, would cause additional delay 
and inaction resulting from a new protracted period of review. 

: Alternatively, the two reports might be returned to the Community 
with the request that a third draft be prepared which would meld 
the two papers. (SUPPORTERS OF OPTION Is None) 
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The second option would be to retain the Willard Report 
while eliminating the most controversial items. Each recom- 
mendation would be evaluated in terms of its effectiveness in 
addressing the leak problem, ease of implementation and degree of 
controversy. On the basis of a cost-benefit analysis the 
controversial issues would be eliminated to ensure implementation 
of the remaining recommendations in the Willard Report. 

The advantage of this approach is that it would diffuse the 
controversy which has surrounded the Report and turn it into a 
consensus document which would be palatable to all Community 
agencies and presumably to those who would have to promulgate 
it. The disadvantage of this strategy is that it might 
prematurely compromise two of the most important recommendations 
(polygraph and prepublication review) contained in the Report 
and, thus, reduce the effectiveness of efforts to eliminate 
unauthorized disclosures of classified information. In this 
regard, the view was expressed that despite deep Administration 
concern about the problem of unauthorized disclosures, it should 
be expected that the Community will have only one opportunity to 
have this issue addressed by the President. Consequently, if the 
Willard Report is weakened, it is unlikely that the Community 
will be able to go back with additional recommendations. 
(SUPPORTERS OF OPTION 2: Energy, State, OSD, DIA) 

The third option is to support the Willard Report in its 
entirety. The Report has been presented to Judge Clark as the 
recommendation of the Interagency Group on Unauthorized Dis- 
closures. The Report was signed by the Attorney General and is 
fully supported by the Director of Central Intelligence. It is 
for Judge Clark to take into account the comments of the various 
agencies and to present the President with his recommendation. 
Rather than prejudging this recommendation, option three would 
simply encourage Judge Clark to reach a decision as expeditiously 
as possible. 

The advantage of this strategy is that we will not be 
negotiating against ourselves by revising our proposal even 
before a response to our proposal has been received. By 
supporting the Willard Report in its entirety, we ensure that all 
of the recommendations will be fully considered. The dis- 
advantage of this strategy is that the continued presence of the 
controversial items, may result in continued paralysis of action 
and may delay implementation of any part of the Willard Report. 
(SUPPORTE RS OF OP TION 3: Justice, Treasury, CIA, Army, Navy, AF, 
FBI, NSA, 
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POINTS FOR CONSIDERATION RELATIVE TO A 
NATIONAL POLICY ON DAMAGE ASSESSMENTS 


I. 


Background 


This paper represents a preliminary effort to examine the 
damage assessment process to determine what, if anything, could 
be done to optimize the process. Rather than attempting a 
definitive study of the subject, an effort has been made to 
identify issues which require further exploration. Positions 
taken on these issues wi3 r J-^d^ermine what additional work is 
necessary in this area. 


As a point of departure it is useful to note that a national 
policy on damage assessments is articulated in Information 
Security Oversight Office (ISOO) Directive No. 1. (32 CFR Part 
2001). This Directive, which is binding on the various 
departments and agencies, was promulgated pursuant to authority 
granted the Director of that Office by the President in Section 
5.2 of Executive. Order 12356 (April 6, 1982). The Directive 
states in Section 2001.47: 

Any person who has knowledge of the loss or 
possible compromise of classified information shall 
immediately report the circumstances to an official 
designated for this purpose by the person's agency 
or organization. The agency that originated the 
information shall be notified of the loss or 
possible compromise so that a damage assessment may 
be conducted and appropriate measures taken to 
negate or minimize any adverse effect of the 
compromise. The agency under whose cognizance the 
loss or possible compromise occurred shall initiate 
an inquiry to (a) determine cause, (b) place 
responsibility, and (c) take corrective measures 
and appropriat e admin istrative, disciplinary, or 


legal action. 


The ISOO Directive attacks the problems of loss or compromise 
of classified information along two dimensions. First, the 
originating agency, that is the agency which owns the material, 
is charged with the responsibility to conduct a damage assessment 
and to take appropriate measures to negate or minimize any 
adverse effect of the compromise. Second, the agency with 
responsibility for the loss or compromise is required to 
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determine how the loss occurred, to take corrective and remedial 
steps to prevent the problem from recurring and to take 
administrative, disciplinary or legal action against those 
responsible for the loss. 


In discussing damage assessments, an expansive definition of 
the term, and of the process, has been adopted. When an incident 
occurs, it would be expected that a four-step process would 
begin: 

First, a preliminary inquiry would be 
undertaken to determine whether ther-a has been a 
compromise of classified information. If a 
compromise has occurred, then a preliminary 
judgment must be made as to whether the compromise 
could reasonably be expected to cause damage to the 
national security. 

Second, if a compromise of classified 
information has occurred and the probability of 
damage to the national security cannot, be 
discounted, then an inventory of the classified 
information involved would be prepared and the 
impact of the compromise on the national security 
would be evaluated. 

Third, if it is determined that the compromise 
could have a significant impact on the national 
security, appropriate countermeasures to negate or 
minimize the effect of the compromise would be 
identified. 

Fourth, remedial or corrective action would be 
specified. An attempt would be made to identify 
the person (s) responsible for the compromise and 
administrative, disciplinary or legal action would 
be proposed to deal with the situation. Even when 
it is not possible to identify the person 
responsible for the compromise, it may be possible 
to examine what went wrong. If existing procedures 
are deemed adequate, but implementation has been 
sloppy, employee notices or additional training may 
be appropriate. If systemic problems or gaps in 
regulations or procedures are identified, then more 
extensive corrective action would be required. 


II . Issues 

A. National Level Guidance With Respect To Damage 
Assessments — Investigative Triggers 

There was near unanimity that a full-blown damage 
assessment would not be appropriate in every case and 
inflexible requirements would be counterproductive. If, for 
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example, a safe were left open in a controlled facility and 
discovered by a security guard soon afterward, cataloging all 
of the items in the safe and assessing the national security 
impact of the possible compromise may not be necessary. On 
the other hand, even in the above circumstance, if the open 
safe contained a master list of safe combinations, it would 
be prudent to change all of the safe combinations. Even at 
the other end of the spectrum discretion is desirable. If, 
for example, a diplomatic pouch containing large sums of 
money were broken into and the money taken while other 
material and documents were left untouched, a damage 
assessment might not be required unless the theft were 
considered to be a cover for the photographing of the 
25X1 documents. 

Despite the unanimity that discretion must be built into 
the system, there was a division of opinion as to whether 
there should be any national level guidance. It was 
suggested that when specialized intelligence equipment or 
classified military equipment is lost, a human source or a 
technical collection system is jeopardized, a diplomatic 
pouch containing classified information is lost, a secure 
facility is penetrated, or espionage occurs, a full damage 
assessment should be required unless the agency head or 
<-m ee expressly determines that this is not necessary. 

25X1 I 

B. Improved Quality Control 

At present there is no way of evaluating, outside of 
existing chains of command, whether damage assessments when 
done are well done. Although there is no clear evidence that 
damage assessments are deficient, there is considerable 
question about the extent to which they are merely 
descriptive rather than analytical and prescriptive. There 
is, moreover, no current ability to hold up a particularly 
good damage assessment as a model for others to emulate. 

There is always the suspicion, however ill-founded, that 
damage assessments prepared by the components most intimately 
involved are self-serving documents which may inflate or 
devalue impacts or which may mask or minimize problems, 
procedural inadequa cies or poor personnel or program 
25X1 management. 

There was a clear consensus, however, that agencies 
should not lose control of the damage assessment process. 

Each agency should conduct its own damage assessment and 
should be free to structure an investigative framework which 
adequately reflects the realities of that agency. On the 
other hand, there was less clarity as to whether adequate, 
quality control could be assured at the program manager level 
or whether a broader agency perspective would be helpful. 

25X1 
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It was suggested that it might be useful to establish a 
separate mechanism within each agency to ensure the timeli- 
ness and quality of damage assessments. There was some 
feeling that a separate mechanism which focused exclusively 
on the quality and timeliness of such assessments could in 
time appreciably enhance the value of such asssessments to 
each agency. The specific mechanism would vary according to 
the unique configuration and structure of each agency. Each 
quality control mechanism, however, would be empowered to 
make recommendations involving specific damage assessments to 
the extent that discrete deficiencies are found. In 
addition, by analyzing large numbers of damage assessments 
over time, the quality control mechanism could make 
recommendations concerning improvement in the methodology and 
approach taken in putting together such assessments. For 
example, it could ensure that the substantive and technical 
expertise represented by the operational components whose 
information was compromised and the specialized knowledge of 
the analytical components able to assess the impact of the 
compromise had been adequately utilized. In addition, it 
could ensure that security, counterintelligence and 
inspection or program audit perspectives had been included. 

It also could review whether damage assessments could better 
be conducted by individuals or teams specially designated to 
examine a particular leak or by units with a permanent 
membership. It could assess whether organizational changes 
were needed in order to spur new thinking or whether there 
was a need to create or improve institutional memory and 
level of experience in examining compromises. 


C. Assessment Implementation 

The most significant parts of a damage assessment are 
its forward looking aspects. Obviously countermeasure 
recommendations help to make a bad situation better. The 
remedial or corrective steps which are designed to determine 
cause, to place responsibility, to recommend administrative, 
disciplinary or legal action, or to implement policy and 
procedural changes are critically important. There is 
considerable question, however, about the extent to which any 
recommendations which are made are actually implemented. It 
is suggested, therefore, that a tickler or review system oe 
established to revisit damage assessments after a three or 
six— month interval to determine whether it is still "business 
as usual, " or whether the changes which have been made are 
really working and are adequate to prevent a recurrence. 

Opponents suggest that under current procedures, the 
chain of command is "responsible for implementing corrective 
or remedial measures; and that there is no need for any change 
in the system. Proponents suggest that under the current 
system the status of damage assessments, the status of 
various recommended courses of action, or even whether the 
case has been closed from an administrative, disciplinary or 
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legal point of view often is unclear. In sum, proponents 
suggest that there is such a variety and diversity of 
disclosures which are reported through so many different 
chains of command that appropria te coo rdination and necessary 
feedback very often is lacking. 


D. Sharing of Information 


The present damage assessment system is deficient 
because of the paucity of mechanisms by which lessons learned 
can be shared. There is some dissatisfaction with the 
current, informal, ad hoc system of exchanging information. 

It is recognized that there is a natural concern about airing 
"dirty linen" in public. There are justifiable concerns 
about security, particularly when compartmented or "bigoted” 
programs are involved. There also is the view that many of 
the remedial measures proposed may be program or organization 
specific with little relevance outside a very narrow 
circle. To be sure there may be natural boundaries beyond 
which the costs of sharing information may exceed the 
benefits. However, even if it is argued that it is not 
useful to share information outside these natural boundaries, 
greater sharing of inf ormati on than currently is the case 
should be encouraged. 


It is suggested that there is a military hardware or 
weapons system grouping. There is an Intelligence Community 
and within that there is an SCI Community. At least within 
each of these groupings information can be pooled. Mistakes 
which have been made on one program or compartment may later 
be made by individuals working on another program or in 
another compartment. It often is possible to generalize from 
remedial measures taken in one program so that other program 
managers can benefit. More to the point, this can be done 
without touching upon the particularly sensitive 
information. In the Boyce-Lee case, for example, it was not 
necessary to discuss the specific company, or the specific 
intelligence system involved in order to share with other 
program managers the utility of the two person rule or the 
desirability of instituting an industrial polygraph 
program. The issue here is whether there should be some 
national level guidance which encourages or mandates sharing 
of information or whether the present system, which largely 
leaves sh aring o f information to each program manager, is 
adequate. 

Currently, the Air Force has a newsletter (published 3 
to 4 times a year) that synopsizes various cases involving 
unauthorized disclosures of SCI which the Air Force 
determines to be of general applicability and interest. The 
Air Force disseminates this newsletter throughout the SCI; 
Community, both inside and outside the Department of 
Defense. By means of this newsletter the SCI Community is 
given the benefit of' Air Force experience in a variety of 
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unauthorized disclosure cases and is able to apply any 
preventive measures necessary to safeguard against a 
repetition elsewhere in the Community of the circumstances 
which led to particular unauthorized disclosures. I 

It is suggested that the Air Force newsletter serve as a 
model for other newsletters which would address the needs and 
interests of various appropriate communities. The SECOM 
could publish such a newsletter regarding cases of broad 
interest to the Intelligence Community, in general, or to the 
SCI Community, in particular. Similarly, the ISOO could be 
tasked with publishing such a newsletter concerning 
unauthorized disclosures within various communities of 
interest that relate to the world of collateral classified 
information. It is significant to note that DCID 1/19, as 
currently revised, provides for sharing with the SECOM and 
the DCI summaries of investigations and re l ated actions in 
cases involving significant compromises. 

E. The Data Base 

Another area of discussion centered upon the proposed 
establishment of an unauthorized disclosure data base. It 
appears that the Department of Justice (DOJ) anu the Federal 
Bureau of Investigation (FBI) are moving inexorably toward 
establishing a data base which would contain all information 
relating to unauthorized disclosures reported to them. DOJ . 
strongly believes that such a data base would be useful to it 
and to the FBI in getting an analytical handle on the problem 
of unauthorized disclosures. That is to say, DOJ is 
interested in analyzing large numbers of unauthorized 
disclosures to determine if there are any significant 
commonalities, patterns, or trends that emerge from the data 
that would aid the FBI in its investigations of such 
matters. With this DOJ initiative on the horizon, it is 
believed that an even broader data base would be useful to 
agencies within various appropriate communities. 

Under a proposal for a broad data base, the 
participating agencies would, above some pre— determined level 
of triviality, contribute information on unauthorized 
disclosures to a central system, whether or not the 
disclosures were reported to DOJ . The greatest concern with 
the establishment of such a system was that in order for the 
system to be effective, it would require that all relevant 
information regarding unauthorized disclosures be fed into 
phe sy stem. This might include very sensitive information. 

The concern expressed fails to take into account the 
fact that other very sensitive data bases already exist with 
appropriate safeguards. For example, there is a Government- 
wide register of human intelligence sources which, though 
extremely sensitive, provides an invaluable reservoir of 
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information that enables the Intelligence Community to more 
efficiently and effectively conduct its assessment and 
recruiting activities. To avoid widespread dissemination of 
sensitive information relating to unauthorized disclosures, 
the. proposed system could be similar in design to the 4C 
System, which is intended to contain an equally sensitive 
data base of all SCI accesses for all SCI programs. Only a 
limited number of people would have access to the proposed 
system and an even more limited number would have access to 
the particularly sensitive information in such a system. 

Hopefully, as a comprehensive analytical platform, such 
a data base could ultimately become an important diagnostic 
tool for the participating agencies. The data base would 
provide useful information concerning the specific types of 
information being disclosed, any correlation between types of 
disclosures and government processes, any correlation between 
types of disclosures and media representatives, and past 
disinformation programs. The information gained from the 
analysis of such a data base would assist in evaluating 
existing security practices and developing any new ones 
determined to be necessary. It would assist in developing 
models of the various types of inadvertent disclosures. It 
would assist in concentrating security resources in specific 
areas where the risk of disclosure is high. It would quickly 
identify old releases, isolate chronic leakers, develop 
countermeasures for disinformation and deception programs. 
Finally, it may be useful in predicting future trends with 
respect to unauthorized disclosures so that anticipatory 
countermeasures may be implemented. 

F. Regulations 

As a final point it was noted that it would be useful 
for those agencies which have not yet issued regulations 
implementing ISOO Directive No. 1 to do so. In addition, if 
any of the above recommendations are adop ted, t hey might be 
included in existing or new regulations. 
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